US20120084840A1 - Terminal connection status management with network authentication - Google Patents

Abstract

A network relay device includes a communication unit, an authentication processing unit, a DHCP snooping processing unit, and a terminal search processing unit. The authentication processing unit creates first information specifying an authenticated terminal device according to web authentication, and manages whether relay of communication data between a terminal device and a node on the specified network is permissible based on the first information. The DHCP snooping processing unit executes snooping of DHCP communication data between a terminal device and a DHCP server, and creates second information specifying a layer 3 address allocated to each terminal device. The terminal search processing unit specifies an authenticated terminal device based on the first information, specifies a layer 3 address allocated to the specified authenticated terminal device based on the second information, and causes the communication unit to send, to the specified layer 3 address, confirmation communication data.

Description

CROSS REFERENCE TO RELATED APPLICATIONS
• The present application claims the priority based on a Japanese Patent Application No. 2010-225111 filed on Oct. 4, 2010, the disclosure of which is hereby incorporated by reference in its entirety.
BACKGROUND
• 1. Technical Field
• The present invention relates to network authentication, and particularly to management of the network connection status of a terminal device for which network authentication is already done.
• 2. Related Art
• Amid the infrastructure shift of communication networks, various methods for increasing network security have been proposed. Network authentication is one of these. Network authentication is an authentication mechanism for managing whether or not a terminal device such as a personal computer (PC) or the like can be connected to a specific network (see JP2003-348114A, for example).
• As network authentication, for example, Web authentication and IEEE 802.1X authentication are known. Web authentication is an authentication method for which an authentication server performs authentication based on authentication information of a terminal device in response to an authentication request issued from the terminal device that runs a Web browser to a network relay device such as a switch or the like that has a Web authentication function. With Web authentication, the network relay device registers the MAC address, user ID, VLAN information or the like of the authenticated terminal device to the authenticated terminal registration table and judges whether it is permissible to relay communication data between a terminal device and nodes on a network with reference to the table. Web authentication can be realized as long as the terminal device is equipped with a Web browser even if it is not equipped with special authentication software such as is used with IEEE 802.1X authentication, so this authentication method has high degree of general versatility.
• With Web authentication, in contrast to an authentication method for which a protocol is established such as IEEE 802.1X authentication, a technology for managing the network connection status of already authenticated terminal devices is not known. For example, with Web authentication, a technology for quickly detecting that the authenticated terminal device has been detached from the network has not been established. When the fact that the authenticated terminal device has been detached from the network is not detected quickly, after the authenticated terminal device is detached from the network, there are cases when another terminal device fraudulently using the MAC address is allowed to connect to the network, so there was room for improvement in terms of security.
SUMMARY
• By taking into account at least part of the problems noted above, an object of the present invention is to improve security on the network by managing the terminal connection status with Web authentication.
• According to one aspect of the present invention, there is provided a network relay device comprising a communication unit, an authentication processing unit, a DHCP snooping processing unit, and a terminal search processing unit. The communication unit sends and receives communication data. The authentication processing unit creates first information specifying an authenticated terminal device according to a result of web authentication that determines whether or not a connection to a specified network by a terminal device connected to the network relay device is permissible, and manages whether or not relay of communication data between a terminal device and a node on the specified network by the communication unit is permissible based on the first information. The DHCP snooping processing unit executes snooping of DHCP communication data relayed by the communication unit between a terminal device and a DHCP server, and creates second information specifying alayer 3 address allocated to each terminal device based on the DHCP communication data. The terminal search processing unit specifies a terminal device that has already been authenticated based on the first information, specifies alayer 3 address allocated to the specified authenticated terminal device based on the second information, and causes the communication unit to send, to thespecified layer 3 address, confirmation communication data for confirming whether or not the specified authenticated terminal is connected to the specified network.
• With this network relay device, the terminal search processing unit specifies the authenticated terminal devices based on first information that specifies authenticated terminal devices created by the authentication processing unit, specifies alayer 3 address allocated to the authenticated terminal device based on second information that specifies alayer 3 address allocated to each terminal device created by the DHCP snooping processing unit, and causes the communication unit to send, to a specifiedlayer 3 address, confirmation communication data that confirms whether the specified authenticated terminal device is connected to a specified network, so it is possible to manage whether an authenticated terminal device is connected to the network (in other words, the network connection status). Because of that, with this network relay device, it is possible to manage terminal connection status with Web authentication and improve security on a network.
• In the network relay device described above, the terminal search processing unit may cause the authentication processing unit to cancel authentication for the specified authenticated terminal device when there is no response to the confirmation communication data sent a predetermined number of times from the specified authenticated terminal device.
• With the network relay device, the terminal search processing unit causes the authentication processing unit to cancel the authentication for the authenticated terminal device when there is no reply from the authenticated terminal device in response to the confirmation communication data sent a predetermined number of times, so it is possible to suppress the occurrence of the circumstance that allows the connection to the network by another terminal which is fraudulently acting as the concerned terminal device after the authenticated terminal device has been detached from the network, making it possible to improve security on the network.
• In the network relay device described above, the terminal search processing unit may create third information specifying alayer 3 address allocated for each authenticated terminal device based on the first information and the second information, and select authenticated terminal devices registered in the third information in sequence as a subject of confirmation of whether it is connected to the specified network.
• With the network relay device, the terminal search processing unit creates third information specifying thelayer 3 address allocated for each authenticated terminal device based on the first information and the second information, and select the authenticated terminal devices registered in the third information in sequence as the confirmation subjects, so it is possible to effectively and efficiently manage the terminal connection status of already authenticated terminal devices, making it possible to improve security on a network.
• In the network relay device described above, the terminal search processing unit may register in the third information an authenticated terminal device when a terminal device is authenticated through the web authentication, and register in the third information alayer 3 address that is registered in the second information in cases when alayer 3 address is not registered in the third information for the authenticated terminal device selected as the confirmation subject, or when alayer 3 address registered in the third information is not identical with thelayer 3 address registered in the second information.
• With this network relay device, it is possible to register in the third information the authenticated terminal devices and the mostrecent layer 3 address allocated for each terminal device, so it is possible to effectively and efficiently manage the terminal connection status of the authenticated terminal devices using the third information, making it possible to improve the security on a network.
• In the network relay device described above, the terminal search processing unit, for an authenticated terminal device selected as the confirmation subject, may determine that the selected authenticated terminal device has been reconnected after being detached once from the specified network, when a same correlation as a correlation of the authenticated terminal device and alayer 3 address registered in the third information is not registered in the second information, and a correlation of the authenticated terminal device and anotherlayer 3 address is registered in the second information.
• With this network relay device, it is possible to detect that an authenticated terminal device is reconnected after once being detached from a specified network, making it possible to further improve security on a network.
• The network relay device described above may further comprise a VLAN setting unit for setting a VLAN to a terminal device so that a VLAN before authentication and a VLAN after authentication do not necessarily match.
• With this network relay device, even when the VLAN of the terminal device is set so that the VLAN before authentication and the VLAN after authentication do not necessarily match, it is possible to specify alayer 3 address allocated to an authenticated terminal device and to send confirmation communication data that confirms whether an authenticated terminal device is connected to a specified network, making it possible to improve security on a network.
• In the network relay device described above, the first information, the second information, and the third information may specify a terminal device using alayer 2 address.
• The present invention can be realized in various aspects. For example, the present invention can be realized in aspects such as a network relay method and device; a network communication method and device; a network authentication method and device; a computer program for accomplishing the functions of such a method or device; a recording medium having such a computer program recorded thereon; and the like.
• These and other objects, features, aspects, and advantages of the present invention will become more apparent from the following detailed description of the preferred embodiments with the accompanying drawings.
BRIEF DESCRIPTION OF THE DRAWINGS
• FIG. 1 is an explanatory drawing schematically showing the configuration of anetwork system10 of an embodiment of the present invention;
• FIG. 2 is an explanatory drawing schematically showing the constitution of theauthentication switch100;
• FIG. 3 is an explanatory drawing showing an example of the contents of the MAC address table MT;
• FIG. 4 is an explanatory drawing showing an example of the contents of the DHCP snooping table DT;
• FIG. 5 is an explanatory drawing showing an example of the contents of the authentication management table AT;
• FIG. 6 is an explanatory drawing showing an example of the contents of the polling management table PT;
• FIG. 7 is a flow chart showing the flow of the Web authentication process with thenetwork system10; and
• FIG. 8 is a flow chart showing the flow of the terminal search process by theauthentication switch100 of this embodiment.
DESCRIPTION OF THE PREFERRED EMBODIMENTS
• The embodiments of the present invention are described below in the indicated order:
A. EmbodimentA-1. Network System Configuration:A-2. Web Authentication Process:A-3. Terminal Search ProcessB. Modifications:A. Embodiment:A-1. Network System Configuration:
• FIG. 1 is an explanatory drawing schematically showing the configuration of anetwork system10 of an embodiment of the present invention. Thenetwork system10 includes aterminal device210, ahub220 that is connectable to theterminal device210, anauthentication switch100 that is connectable to thehub220, alayer 3switch230 connected to theauthentication switch100, and anauthentication server240 and aDHCP server250 connected to thelayer 3switch230. Each structural element within thenetwork system10 is connected via a link. The link is a transmission path for communication data, and for example is constituted by a UTP cable, an STP cable, an optical fiber, a coaxial cable, wireless or the like.
• Theterminal device210 is an information processing device used by a user, and for example is constituted by a personal computer (PC). Thehub220 is a network relay device that relays communication data on a network with a first layer (physical layer) of an OSI reference model. Theauthentication switch100 is a network relay device (layer 2 switch) that relays communication data on a network with a second layer (data link layer) of an OSI reference model, and also has a network authentication function for managing whether a connection to a specified network NET by theterminal device210 is permissible. Thelayer 3switch230 is a network relay device that relays communication data on a network with a third layer (network layer) of an OSI reference model. Theauthentication server240 is a RADIUS server that performs Web authentication for determining whether a connection to the network NET by theterminal device210 is permissible according to an authentication request from theauthentication switch100. TheDHCP server250 is a server that automatically allocates an IP address or the like as alayer 3 address to theterminal device210.
• FIG. 2 is an explanatory drawing schematically showing the constitution of theauthentication switch100. Theauthentication switch100 includes acommunication unit124 and a MAC address table MT. Thecommunication unit124 has a plurality of physical ports (not illustrated), references the MAC address table MT, and performs sending and receiving of communication data via the physical ports. Thecommunication unit124 is constituted by an ASIC (application-specific IC) or the like.
• FIG. 3 is an explanatory drawing showing an example of the contents of the MAC address table MT. The MAC address table MT stipulates a correlation of a MAC address as alayer 2 address of aterminal device210, the number of a VLAN to which aterminal device210 belongs, and the number of a physical port to which aterminal device210 is connected. For example, withFIG. 3, the MAC address table MT shows that theterminal device210 having the MAC address “MAC-A” belongs to the VLAN of VLAN no. “200”, and is connected to the physical port of the port no. “1.” Note that with this embodiment, the individual correlations in each table are also called records.
• Thecommunication unit124, while performing sending and receiving of communication data, references information indicating a destination MAC address, a sending source MAC address, a VLAN no. and the like contained in the communication data, newly registers the records in the MAC address table MT, and updates already registered records. Also, with this embodiment, thecommunication unit124 has an aging function of deleting from the MAC address table MT the records for MAC addresses for which communication data is not relayed during an aging time of a preset length.
• The authentication switch100 (FIG. 2) includes, as processing units for performing predetermined processes, anauthentication processing unit122, a DHCPsnooping processing unit126, a terminalsearch processing unit128, and aVLAN setting unit132. Each of these processing units is realized for example by a CPU (not illustrated) reading and executing a computer program stored in an internal memory. Also, theauthentication switch100 includes a DHCP snooping table DT, an authentication management table AT, and a polling management table PT as information used for each processing unit.
• The DHCPsnooping processing unit126 detects DHCP communication data (DHCP message) between theterminal device210 and theDHCP server250 relayed via thecommunication unit124, and creates or updates the DHCP snooping table DT based on the DHCP message.FIG. 4 is an explanatory drawing showing an example of the contents of the DHCP snooping table DT. The DHCP snooping table DT stipulates a correlation (record) of a MAC address of aterminal device210, an IP address allocated to aterminal device210, the number of a VLAN to which aterminal device210 belongs, and the number of a physical port to which aterminal device210 is connected. For example, with the example inFIG. 4, the DHCP snooping table DT shows that theterminal device210 having the MAC address “MAC-A” belongs to the VLAN of VLAN no. “200”, is connected to the physical port of port no. “1”, and the IP address “IP-A” is allocated to theterminal device210. Note that the DHCP snooping table DT corresponds to the second information of the present invention. When thecommunication unit124 detects an IP address allocation message (DHCP ACK message) sent from theDHCP server250 to aterminal device210, the DHCPsnooping processing unit126 receives a copy of the detected message from thecommunication unit124, and newly registers a record in the DHCP snooping table DT or updates an already registered record with reference to information indicating a destination MAC address or an allocation IP address or the like included in the detected message.
• Theauthentication processing unit122 works jointly with theauthentication server240 to perform Web authentication of aterminal device210, creates an authentication management table AT that specifies an authenticated terminal devices according to the Web authentication results, and manages whether relay of communication data between aterminal device210 and a nodes on the network NET is permissible by thecommunication unit124 based on the authentication management table AT.FIG. 5 is an explanatory drawing showing an example of the contents of the authentication management table AT. The authentication management table AT stipulates a correlation (record) of a MAC address of an authenticatedterminal device210, a user ID that specifies a user of aterminal device250, the number of a VLAN to which aterminal device210 belongs, and the number of a physical port to which aterminal device210 is connected. For example, with the example inFIG. 5, the authentication management table AT shows that theterminal device210 having the MAC address “MAC-A” is already authenticated, and that it belongs to the VLAN with the VLAN no. “200” and is connected to the physical port with the port no. “1.” Note that the authentication management table AT corresponds to the first information of the present invention. Theauthentication processing unit122 newly registers a record to the authentication management table AT or deletes an already registered record according to the result of the Web authentication or to the result of the terminal search process described later. The Web authentication process using theauthentication processing unit122 is described later.
• The terminalsearch processing unit128 refers the polling management table PT to perform terminal search processing for confirming whether an authenticatedterminal device210 is connected to the network NET.FIG. 6 is an explanatory drawing showing an example of the contents of the polling management table PT. The polling management table PT stipulates a correlation (record) of a MAC address of aterminal device210, an IP address allocated to aterminal device210, a user ID of a user of aterminal device210, the number of a VLAN to which aterminal device210 belongs, and the number of a physical port to which aterminal device210 is connected. Note that the polling management table PT corresponds to the third information of the present invention. The terminal search process by the terminalsearch processing unit128 is described later.
• TheVLAN setting unit132 sets a VLAN for each physical port of thecommunication unit124. Note that theauthentication switch100 of this embodiment can selectively apply the fixed VLAN method for which the
• VLAN to which theterminal device210 belongs does not change before and after authentication, or the dynamic VLAN method for which the VLAN to which theterminal device210 belongs changes before and after authentication. With the description below, the dynamic VLAN method is selected for theauthentication switch100.
A-2. Web Authentication Process:
• FIG. 7 is a flow chart showing the flow of the Web authentication process with thenetwork system10. The Web authentication process is a process that performs authentication of aterminal device210 for managing whether it is permissible to connect to the network NET by theterminal device210. Before execution of Web authentication regarding a certainterminal device210, connection by the terminal device210 (or anotherterminal device210 fraudulently using the MAC address of the concerned terminal device210) to the network NET is prohibited by theauthentication switch100.
• When a user of aterminal device210 connects theterminal device210 to ahub220, theVLAN setting unit132 of theauthentication switch100 connected to theconcerned hub220 has the connectedterminal device210 belong to the VLAN for before authentication (with the example inFIG. 7, VLAN “100”). When theterminal device210 makes a request for an IP address for before authentication to theDHCP server250 with the VLAN for before authentication (step S110), theDHCP server250 allocates an IP address to the terminal device210 (step S120). The IP address allocated at this time is an IP address that has an IP subnet corresponding to the VLAN to which a terminal device belongs to before authentication, and is a temporary IP address for executing Web authentication. Note that as is well known, IP address allocation is realized by the following steps being executed in sequence: broadcasting of a DHCP Discover message by aterminal device210, sending to theterminal device210 of a DHCP Offer message notifying an allocatable IP address by theDHCP server250 that received the Discover message, sending to theDHCP server250 of a DHCP Request message that requests a specific IP address by theterminal device210 that received the Offer message, and sending to theterminal device210 of a DHCP ACK message that notifies an allocated IP address by theDHCP server250 that received the Request message. Theauthentication switch100 relays each DHCP message exchanged between theterminal device210 and theDHCP server250.
• The DHCPsnooping processing unit126 of theauthentication switch100 executes snooping of each DHCP message, specifies the IP address allocated to theterminal device210, correlates a specified IP address to theterminal device210 MAC address, VLAN number or the like, and registers the correlation to the DHCP snooping table DT (FIG. 4) (step S130).
• Theterminal device210 that received allocation of the IP address requests that theauthentication switch100 give authentication for connecting to the network NET through http/https (step S140). In specific terms, when theterminal device210 operating a Web browser sends an authentication request packet to theauthentication switch100 using the allocated IP address, theauthentication processing unit122 having a function as a Web server sends the authentication information registration screen data to theterminal device210. Theterminal device210 receives the authentication information registration screen data and displays it on the authentication information registration screen, and sends the authentication information input by the user on the screen (e.g. user ID and password) to theauthentication switch100.
• When theauthentication processing unit122 of theauthentication switch100 receives authentication information from theterminal device210, theauthentication processing unit122 transfers the authentication information to theauthentication server240 and requests authentication of the terminal device210 (step S150). Theauthentication server240 determines that the authentication of theterminal device210 is unsuccessful when the authentication information of theterminal device210 has not been registered in the authentication database (step S160: No). In this case, theauthentication server240 gives authentication unsuccessful notification to theauthentication switch100, and theauthentication switch100 gives authentication unsuccessful notification to the terminal device210 (step S230).
• On the other hand, theauthentication server240 determines that the authentication of theterminal device210 is successful when the authentication information of the subjectterminal device210 has been registered in the authentication database (step S160: Yes). In this case, theauthentication server240 gives authentication successful notification to theauthentication switch100, and also notifies theauthentication switch100 information that specifies the VLAN to which theterminal device210 belongs after authentication (with the example inFIG. 7, VLAN “200”) (step S170). With this embodiment, the dynamic VLAN method is selected, so the VLAN to which theterminal device210 belongs after authentication is different from the VLAN to which it belonged before authentication.
• Theauthentication processing unit122 of theauthentication switch100 that received the authentication successful notification changes the VLAN to which theterminal device210 belongs to the VLAN notified from theauthentication server240, and notifies the change to theterminal device210, and also does additional registration of a record regarding the authenticatedterminal device210 to the authentication management table AT (FIG. 5) (step S180). The terminalsearch processing unit128 of theauthentication switch100 additionally registers in the polling management table PT (FIG. 6) a record corresponding to the record additionally registered in the authentication management table AT (step S190). Therefore, in the record additionally registered in the polling management table PT, the MC address, the user ID, the VLAN no., and the port no. are recorded, but at this point in time, the IP address is not recorded (it is a blank space).
• Theterminal device210 that received the authentication successful notification makes a request for an IP address to theDHCP server250 with the VLAN to which it newly belongs (with the example inFIG. 7, VLAN “200”) (step S200). TheDHCP server250 that receives the request allocates an IP address to the terminal device210 (step S210). The IP address allocated at this time is an IP address having an IP subnet corresponding to the VLAN to which theterminal device210 belongs after authentication.
• At this time, the DHCPsnooping processing unit126 of theauthentication switch100, the same as before authentication, executes snooping of each DHCP message exchanged between theterminal device210 and theDHCP server250, specifies the IP address allocated to theterminal device210, correlates the specified IP address to theterminal device210 MAC address, VLAN no. or the like, and registers the correlation to the DHCP snooping table DT (FIG. 4) (step S220). The record regarding thisterminal device210 is already registered in the DHCP snooping table DT, and the DHCPsnooping processing unit126 updates to the IP address and VLAN no. for this record after authentication.
• With the Web authentication process described above, authentication of theterminal device210 is performed, and the IP address for use after authentication is allocated to theterminal device210 for which authentication was successful. Theauthentication switch100 relays communication data between the authenticatedterminal device210 and nodes on the network NET. By doing this, it is possible to connect to the network NET by theterminal device210.
A-3. Terminal Search Process:
• FIG. 8 is a flow chart showing the flow of the terminal search process by theauthentication switch100 of this embodiment. The terminal search process is a process which confirms whether the authenticatedterminal device210 is still connected to the network NET, and cancels authentication forterminal devices210 determined to already be detached from the network NET.
• By selecting one record registered in the polling management table PT at a specified timing, the terminalsearch processing unit128 of theauthentication switch100 sets theterminal device210 corresponding to the MAC address of the selected record as the terminal device subject to polling (step S410). Note that as described above, because records are additionally registered to the polling management table PT corresponding to the records additionally registered to the authentication management table AT at the time authentication is successful, theterminal device210 corresponding to the MAC address of the record registered to the polling management table PT is an authenticatedterminal device210. That is, the terminalsearch processing unit128 selects one authenticatedterminal device210 as the terminal device subject to polling with reference to the polling management table PT created based on the authentication management table AT.
• The terminalsearch processing unit128 determines whether the IP address of the terminal device subject to polling is registered in the polling management table PT (step S420). Note that when theterminal device210 is set to be the terminal device subject to polling for the first time after authentication, the IP address is not registered in the polling management table PT.
• When the IP address of theterminal device210 is not registered in the polling management table PT, the terminalsearch processing unit128 searches the DHCP snooping table DT using the MAC address registered in the polling management table PT as the key for search (step S430). When a record corresponding to the concerned MAC address is detected in the DHCP snooping table DT (step S440: Yes), the terminalsearch processing unit128 performs polling processing using the IP address of the detected record (step S450). Here, polling processing is the process of causing thecommunication unit124 to send a confirmation packet requesting a reply to the IP address of the detected record as the destination address.
• When there is a reply to the confirmation packet from the terminal device210 (step S460: Yes), theterminal device210 is confirmed to be connected to the network NET. In this case, the terminalsearch processing unit128 additionally registers the detected IP address in the record corresponding to the terminal device subject to polling with the polling management table PT (step S470). By doing this, the correlation of the MAC address and the IP address for the terminal device subject to polling is registered in the polling management table PT. After that, the terminalsearch processing unit128 resets the number of polling times of the concerned terminal device210 (step S480), and performs the process of selecting the next terminal device subject to polling (step S410).
• When there is no reply to the confirmation packet from the terminal device210 (step S460: No), the terminalsearch processing unit128 repeatedly executes the polling process (step S450) and the determination of if there is a reply (step S460) until the polling process execution count (number of times the confirmation packet is sent) exceeds a preset stipulated value. When the polling process execution count exceeds the stipulated value (step S490: No), the terminalsearch processing unit128 judges that theterminal device210 has already been detached from the network NET. In this case, the terminalsearch processing unit128 deletes the record regarding the concernedterminal device210 from the polling management table PT (step S500), and causes theauthentication processing unit122 to cancel the authentication of the concernedterminal device210 by deleting the record for the concernedterminal device210 from the authentication management table AT (step S510). By doing this, the connection by the concerned terminal device210 (or anotherterminal device210 fraudulently using the MAC address of the concerned terminal device210) to the network NET is prohibited by theauthentication switch100.
• Note that with the DHCP snooping table DT search (step S430) using the MAC address of theterminal device210 registered in the polling management table PT as the key for search, when a record corresponding to the concerned MAC address is not detected (step S440: No), the process returns to selection of the next terminal device subject to polling (step S410).
• With the determination of whether the IP address of the terminal device subject to polling is registered in the polling management table PT (step S420), when the IP address is already registered in the polling management table PT, the terminalsearch processing unit128 searches the DHCP snooping table DT using a combination of the MAC address and IP address of the terminal device subject to polling registered in the PT as the key for search (step S520). When a record corresponding to the concerned combination is detected in the DHCP snooping table DT (step S530: Yes), the terminaldetection processing unit128 performs polling processing using the IP address registered in the polling management table PT (in other words, the IP address registered in the DHCP snooping table DT), and performs the same processing as described above according to whether there is a reply to the polling process (steps S460 to S510).
• With the DHCP snooping table DT search using a combination of the MAC address and IP address of the terminal device subject to polling registered in the polling management table PT (step S520), when an applicable record is not detected (step S530: No), the terminalsearch processing unit128 searches the DHCP snooping table DT using only the MAC address of the terminal device subject to polling as the key for search (step S540). When there is no applicable record in the DHCP snooping table DT (step S550: No), it is conceivable that the polling terminal device has not yet fetched the IP address using DHCP, so confirmation of the connection status is put off until later, and the process returns to selection of the next terminal device subject to polling (step S410).
• On the other hand, when an applicable record is detected in the DHCP snooping table DT (step S550: Yes), the terminalsearch processing unit128 determines that the terminal device subject to polling was detached once from the network NET, has been reconnected to the network NET via the same physical port as before detachment or another physical port, and has fetched a new IP address. In this case, polling processing (step S450) is performed using the IP address registered in the record detected with the DHCP snooping table DT, and the same process as described above is performed according to whether there is a reply to the polling process (steps S460 to S510).
• As described above, with the terminal search process by theauthentication switch100 of this embodiment, the terminalsearch processing unit128 selects one authenticatedterminal device210 as the terminal device subject to polling using the polling management table PT created based on the authentication management table AT, specifies the IP address allocated to the terminal device subject to polling using the DHCP snooping table DT, and causes the communication unit to send, to the specified IP address, a confirmation packet confirming whether the terminal device subject to polling is connected to the network NET. Consequently, theauthentication switch100 is able to manage whether the authenticatedterminal device210 is still connected to the network NET (in other words, the terminal connection status). Thus, with theauthentication switch100 of this embodiment, it is possible to suppress the occurrence of the situation that allows the connection to the network NET by anotherterminal device210 fraudulently using the MAC address of the concernedterminal device210 after the authenticatedterminal device210 is detached from the network NET, making it possible to improve the security on the network.
• More specifically, when there is no reply from theterminal device210 to the confirmation packet sent a predetermined number of times, theauthentication switch100 determines that theterminal device210 has already been detached from the network NET, and cancels the authentication for the concernedterminal device210. Consequently, with theauthentication switch100 of this embodiment, it is possible to quickly detect that the authenticatedterminal device210 is detached from the network NET, and it is possible to quickly cancel authentication for theterminal device210 that is detached from the network NET, making it possible to improve security on the network.
• Note that the DHCP snooping function of executing snooping of DHCP messages exchanged between theterminal device210 and theDHCP server250 and the DHCP relay function of relaying DHCP messages exchanged between theterminal device210 and theDHCP server250 are already known technologies, and it is possible to detect the IP address of theterminal device210 using these functions. However, the DHCP relay function and the DHCP snooping function cannot detect whether theterminal device210 is authenticated or not. Also, with theauthentication switch100 of this embodiment, the dynamic VLAN method is selected, for which the VLAN to which theterminal device210 belongs before and after authentication is changed and the IP address allocated to theterminal device210 is also changed. Furthermore, when the authenticatedterminal device210 is reconnected to the network NET after being detached from the network NET, the IP address of theterminal device210 may be changed. Because of that, it has not been possible to manage the network connection status of authenticatedterminal devices210 by simply detecting the IP address of theterminal device210 using the DHCP relay function or the DHCP snooping function. With theauthentication switch100 of this embodiment, by using the polling management table PT created based on the authentication management table AT, it is possible to grasp the situation of the authenticatedterminal device210, and by specifying the IP address allocated to the authenticatedterminal device210 using the DHCP snooping table DT, it is possible to manage the network connection status of the authenticatedterminal device210 even in an environment for which the IP address of theterminal device210 may be changed, so it is possible to improve the security of the network.
• Also, with theauthentication switch100, using the aging function of the MAC address table MT, it is possible that authentication will be cancelled for theterminal device210 corresponding to the MAC address deleted by the aging function, but in this case, even if it is aterminal device210 that has not actually been detached from the network NET, it is possible for the authentication of theterminal device210 to be cancelled for example if the user is away from his desk or the like and communication was not performed. In a case such as this, it is necessary to execute Web authentication of theterminal device210 again. When the aging time is set longer to avoid the occurrence of this kind of circumstance, it is not possible to sufficiently increase the security of the network. On the other hand, when the aging time is set shorter, it is possible that the aforementioned circumstance will occur and the user will lose convenience, and also, it is possible that there will be an increase in the communication load because of flooding processing to transfer all the communications related to theterminal device210 having the deleted MAC address to the all VLAN, so this is not desirable. Theauthentication switch100 of this embodiment regularly sends a confirmation packet to the authenticatedterminal device210 connected to the network NET, so it is possible to suppress the occurrence of the circumstance of cancellation of the authentication of theterminal device210 that is not detached from the network NET through aging processing.
• Also, with theauthentication switch100 of this embodiment, when the same correlation as the correlation of the MAC address and the IP address registered in the polling management table PT is not registered in the DHCP snooping table DT regarding the authenticatedterminal device210 selected as the terminal device subject to polling, and the correlation of the concerned MAC address and another IP address is registered in the DHCP snooping table DT, the selected authenticatedterminal device210 is determined to have been reconnected after once being detached from the network NET. Thus, with theauthentication switch100 of this embodiment, it is possible to detect detachment or movement of the authenticatedterminal device210, and it is possible to further improve the security of the network.
B. Modifications:
• The invention is not limited to the embodiment and its applications discussed above but may be actualized in diversity of other embodiments and applications within the scope of the invention. Some examples of possible modification are given below.
B1. Modification 1:
• The configuration of thenetwork system10 with the embodiments noted above is nothing more than an example, and various modifications are possible. For example, thenetwork system10 shown inFIG. 1 is equipped with a plurality ofterminal devices210 andauthentication switches100, but thenetwork system10 can also be equipped respectively with at least oneterminal device210 andauthentication switch100. Also, with thenetwork system10, theterminal device210 and theauthentication switch100 can also be directly connected without going via ahub220. Also, with thenetwork system10, theauthentication server240 and theDHCP server250 can also be connected with thelayer 3switch230 via another node.
• Theauthentication switch100 can also have a function as an L3 switch. Alternatively, theauthentication switch100 can also have a function as an authentication server and a DHCP server. In this case, the Web authentication process can also be executed using the authentication server function and/or the DHCP server function that theauthentication switch100 has.
B2. Modification 2:
• The contents of each table (MAC address table MT, DHCP snooping table DT, authentication management table AT, polling management table PT (FIG. 3 to 6)) with the embodiments noted above are nothing more than examples, and it is also possible for each table to not include a portion of the contents shown in the drawings, or to include contents other than the contents shown in the drawings.
B3. Modification 3:
• With the embodiments noted above, the terminalsearch processing unit128 generates the polling management table PT based on the authentication management table AT and the DHCP snooping table DT, and performs terminal search processing using the polling management table PT, but the terminalsearch processing unit128 can also be an item that does not generate the polling management table PT, and that uses the authentication management table AT and the DHCP snooping table DT to perform terminal search processing in the same way.
B4. Modification 4:
• With the terminal search process of the embodiments noted above (FIG. 8), the next processing contents change according to the results of the determination of whether the IP address of the terminal device subject to polling is registered in the poling management table PT (step S420), but it is also possible to execute the DHCP snooping table DT search (step S430) using the MAC address of the terminal device subject to poling as the key for search regardless of whether the IP address of the terminal device subject to polling is registered in the poling management table PT (the determination of step S420 is not executed). However, as with the embodiments noted above, when the determination of step S420 is executed, and the IP address of the terminal device subject to polling is registered in the polling management table PT, if the DHCP snooping table DT search (step S520) is executed using the combination of the MAC address and IP address of the terminal device subject to poling as the key, it is possible to detect that the authenticatedterminal device210 once detached from the network NET is reconnected, so this is desirable.
B5. Modification 5:
• With the embodiments noted above, we described an example using the dynamic VLAN method, but even in cases when the fixed VLAN method is used, by doing the terminal search processing of this embodiment, it is possible to manage whether the authenticatedterminal device210 is connected to the network NET (terminal connection status), making it possible to improve security on the network.
B6. Modification 6:
• With the embodiments noted above, the MAC address is used as thelayer2 address, and the IP address is used as thelayer 3 address, but it is also possible to use as appropriate the address according to the protocol used for the Web authentication process or terminal search process as thelayer 2 address andlayer 3 address.
B7. Modification 7:
• Some of the features implemented through hardware in the embodiments noted above may be replaced by software, and conversely some of the features implemented through software may be replaced by hardware.

Claims (8)

1. A network relay device, comprising:

a communication unit for sending and receiving communication data,

an authentication processing unit for creating first information specifying an authenticated terminal device according to a result of web authentication that determines whether or not a connection to a specified network by a terminal device connected to the network relay device is permissible, and for managing whether or not relay of communication data between a terminal device and a node on the specified network by the communication unit is permissible based on the first information,

a DHCP snooping processing unit for executing snooping of DHCP communication data relayed by the communication unit between a terminal device and a DHCP server, and for creating second information specifying a layer 3 address allocated to each terminal device based on the DHCP communication data, and

a terminal search processing unit that specifies a terminal device that has already been authenticated based on the first information, specifies a layer 3 address allocated to the specified authenticated terminal device based on the second information, and causes the communication unit to send, to the specified layer 3 address, confirmation communication data for confirming whether or not the specified authenticated terminal is connected to the specified network.

2. A network relay device according toclaim 1, wherein

the terminal search processing unit causes the authentication processing unit to cancel authentication for the specified authenticated terminal device when there is no response to the confirmation communication data sent a predetermined number of times from the specified authenticated terminal device.

3. A network relay device according toclaim 1, wherein

the terminal search processing unit creates third information specifying a layer 3 address allocated for each authenticated terminal device based on the first information and the second information, and selects authenticated terminal devices registered in the third information in sequence as a subject of confirmation of whether it is connected to the specified network.

4. A network relay device according toclaim 3, wherein

the terminal search processing unit registers in the third information an authenticated terminal device when a terminal device is authenticated through the web authentication, and registers in the third information a layer 3 address that is registered in the second information in cases when a layer 3 address is not registered in the third information for the authenticated terminal device selected as the confirmation subject, or when a layer 3 address registered in the third information is not identical with the layer 3 address registered in the second information.

5. A network relay device according toclaim 4, wherein

the terminal search processing unit, for an authenticated terminal device selected as the confirmation subject, determines that the selected authenticated terminal device has been reconnected after being detached once from the specified network, when a same correlation as a correlation of the authenticated terminal device and a layer 3 address registered in the third information is not registered in the second information, and a correlation of the authenticated terminal device and another layer 3 address is registered in the second information.

6. A network relay device according toclaim 1, further comprising:

a VLAN setting unit for setting a VLAN to a terminal device so that a VLAN before authentication and a VLAN after authentication do not necessarily match.

7. A network relay device according toclaim 1, wherein

the first information, the second information, and the third information specify a terminal device using a layer 2 address.

8. A network relay method, comprising:

creating first information specifying an authenticated terminal device according to a result of web authentication that determines whether or not a connection to a specified network by a terminal device is permissible, and managing whether or not relay of communication data between a terminal device and a node on the specified network is permissible based on the first information,

executing snooping of DHCP communication data relayed between a terminal device and a DHCP server, and creating second information specifying a layer 3 address allocated to each terminal device based on the DHCP communication data, and

specifying a terminal device that has already been authenticated based on the first information, specifying a layer 3 address allocated to the specified authenticated terminal device based on the second information, and sending, to the specified layer 3 address, confirmation communication data for confirming whether or not the specified authenticated terminal is connected to the specified network.

Images